Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
6.5
CVE-2026-10018: Chrome, Chromium and WebKit browsers may expose memory data
CVE-2026-10018 · published 5 months ago
Summary
Versions of Google Chrome, Chromium and related WebKit-based browsers released before the latest update can be tricked by a specially crafted web page to read parts of the program’s memory. This could allow an attacker to see information that should remain private. Upgrade all affected browsers to the newest version to close the gap.
What to do
- Update debian chromium to version 148.0.7778.215-1~deb12u1.
- Update debian chromium to version 148.0.7778.215-1~deb13u1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | chrome |
< 148.0.7778.216 < 148.0.7778.215 cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
|
| Debian:11 | debian | chromium | All versions |
| Debian:12 | debian | chromium |
< 148.0.7778.215-1~deb12u1 Fix: upgrade to 148.0.7778.215-1~deb12u1
|
| Debian:13 | debian | chromium |
< 148.0.7778.215-1~deb13u1 Fix: upgrade to 148.0.7778.215-1~deb13u1
|
| Debian:14 | debian | chromium | All versions |
| Ubuntu:16.04:LTS | canonical | qtwebkit-opensource-src | All versions |
| Ubuntu:16.04:LTS | canonical | webkit2gtk | All versions |
| Ubuntu:16.04:LTS | canonical | qtwebkit-source | All versions |
| Ubuntu:16.04:LTS | canonical | webkitgtk | All versions |
| Ubuntu:20.04:LTS | canonical | wpewebkit | All versions |
Original advisory text
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium secur...
Integer overflow in ANGLE in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium)
References
- https://chromereleases.googleblog.com/2026/05/stable-channel-update-for-desktop_...
- https://issues.chromium.org/issues/504175501
- https://security-tracker.debian.org/tracker/CVE-2026-10018 Vendor Advisory
- https://ubuntu.com/security/CVE-2026-10018 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-10018 Third Party Advisory
- https://webkitgtk.org/security/WSA-2026-0006.html Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Severity
6.5
Medium
Type
CWE-472External Control of Assumed-Immutable Web Parameter
Timeline
Published28 May 2026
Updated29 Oct 2026
First seen29 May 2026
Track software like this
Free during beta